"We don't train on your data" is not zero retention

When vendors state "we don't train on your data," customers frequently interpret this as three separate assurances: no data retention, no future reading of stored information, and compliance with GDPR guidelines. These concepts are distinct and cannot be combined. To truly separate these aspects, it is crucial to directly consult each provider's published information.

For instance, OpenAI's enterprise privacy page confirms that by default, they do not utilize business data for model training; this training only occurs with explicit consent.

However, the document also clarifies that chats are archived forever by default until manually erased. For Enterprise clients, OpenAI provides the option to customize retention periods, but the minimum period is set at 90 days. Anthropic provides a similar set of assurances regarding their Claude Enterprise service, noting that conversation data is retained indefinitely by default unless a custom retention period is established, with a 30-day minimum if a custom period is chosen.

Critical to note is that the absence of training does not guarantee zero retention. In practice, vendors often store chat histories for extended periods, necessary for features like history recall and compliance provisions. The idea of "zero data retention" (ZDR) pertains to a specific type of arrangement where prompts and responses are discarded immediately following the API response. This means that even though the provider does not train on the data, it still exists in memory until the session concludes.

Anthropic explicitly highlights that a ZDR arrangement on their API key does not apply to browser interfaces like Claude Teams or Claude Enterprise. This discrepancy arises because the browser interface utilizes a different service that cannot be set to ZDR. Consequently, even if a ZDR API key is used, conversations conducted through the web interface remain retained.

When evaluating these claims, it is advisable to pose three specific questions to each vendor: first, whether they train on the provided data; second, how long they retain this data; and third, if there is a "zero data retention" option for the data exchange.

Additionally, providers often include exceptions such as retaining abuse logs, flagged content, and data required for certain tools. These additional considerations should not be overlooked. It's also important to understand that the Data Processing Agreement (DPA) is a separate document outlining the roles and responsibilities of the parties involved, and should not be mistaken for the answers to the three key questions about data training, retention, and zero retention.

For those seeking concrete examples, a comprehensive and regularly updated database of vendor promises, complete with dated sources, can be found at Ostrafile.